phpreg

Documentation

Overview

Package phpreg asks Packagist what it knows about the Composer packages a diff touches. deps.dev has no Composer/Packagist system at all, so for PHP this package IS the metadata layer, not a fallback:

• Release ages and the ⏱ cooldown flag, from the per-version `time` Packagist records.
• Abandoned packages (Composer's deprecation mechanism) land in the deprecation lane, with the suggested replacement when the maintainer named one.
• License changes old → new, from the per-version license list.
• Unlisted detection: an incoming version missing from Packagist while the package's other versions ARE listed is what an unpublished/deleted release looks like. Packages Packagist does not know at all (private registries, VCS pins) are never flagged, and the composer.lock parser marks non-Packagist sources NonRegistry besides.
• The upstream source repository, which the changelog layers turn into verified compare links and release notes.

One anonymous GET per changed package. The native build reads Composer's own p2 metadata endpoint (repo.packagist.org — the CDN `composer update` itself hammers, no auth, no limits); it sends no CORS headers, so the browser (wasm) build sets UseAPI and reads the CORS-open packagist.org/packages/{name}.json instead.

Index

• Variables
• func Annotate(diffs []diffx.FileDiff, freshDays int) (bool, error)

Variables

var APIURL = "https://packagist.org"

APIURL is the packagist.org API base (wasm builds); a var so tests can fake it.

var Now = time.Now

Now is a var so tests can pin the clock.

var RepoURL = "https://repo.packagist.org"

RepoURL is the p2 metadata base (native builds); a var so tests can fake it.

var UseAPI = false

UseAPI switches every lookup to the packagist.org API, which allows cross-origin requests. The browser (wasm) build sets it; the p2 endpoint is preferred everywhere else per Packagist's own guidance.

Functions

func Annotate

func Annotate(diffs []diffx.FileDiff, freshDays int) (bool, error)

Annotate fills Packagist metadata on the diffs; see the package comment for what it covers. The returned bool reports whether at least one package was actually vetted against Packagist (callers use it to decide whether release metadata was checked at all, since deps.dev never covers PHP). freshDays mirrors -fresh-days. Best-effort: per-package failures skip that package; only total failure returns an error.